Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Herz- und Seelenstimme e.V.
Hohlgasse 5, 66839 Schmelz, Germany
Authorized representative (Board): Louisa Yalden
Email: herz-und-seelenstimme@tutamail.com

2. General information on data processing

As a matter of principle, we collect and use our users' personal data only to the extent necessary to provide a functional website as well as our content and services. Personal data is collected and used only with the users' consent or where the processing is permitted by law.

3. Contact form & email contact

If you contact us via the contact form or by email, the data you provide (name, email address, message and, where applicable, your interest in particular offerings) will be stored by us in order to process your inquiry and in case of follow-up questions. Name, email address and message are required so that we can reply to you; all other information is voluntary.

Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries). This data is not passed on to third parties. The data will be deleted as soon as it is no longer required for the purpose for which it was collected, and no later than after 3 years.

When you submit the contact form, your entries are forwarded to us by email via the server of our hosting provider (see the “Hosting” section). The data is not stored permanently on the website itself. Exception: if you tick the box saying you would like to be informed about new dates, workshops and offerings, we store your name and email address in a non-public list on this server (see Section 5). A hidden field in the form serves solely to protect against automated spam; no additional data about you is collected through it. Please note that emails may be transmitted unencrypted; therefore, please do not send us any particularly confidential information.

4. Registration for the Christmas Singing (project choir)

If you register for the Schmelz Christmas Singing (Schmelzer Weihnachtssingen) via the registration form, we process the following data: full name, date of birth, email address, postal address (street, postcode, town/city), optionally your phone number, voice type, interest in a solo and comments, as well as your answer regarding consent to photos and videos and whether you would like to be informed about upcoming projects. For participants under 18, we additionally collect the name and consent of the parent or legal guardian, who is also the invoice recipient. Name, date of birth, email address and postal address are required; without them we cannot process the registration or issue an invoice. All other information is voluntary.

The purpose of the processing is the organization and running of the project choir, the calculation of the participation fee (the date of birth is used to classify participants as a child or an adult as of the first rehearsal date and for the protection of minors), the creation and sending of the invoice, the matching of incoming payments, and communication with you.

After submitting the form, you will receive a confirmation by email with the invoice and bank details. The association is notified of the new registration by email; the invoice is also stored in the protected administration area on the hosting provider’s server, as it must be retained. The invoice contains your name or that of the invoice recipient, as well as the postal address. If you pay the fee by bank transfer, your bank processes the payment data; our bank sees your name and the payment reference.

Reduced fee: If you let us know that the fee is difficult for you to afford, we treat this information confidentially and use it exclusively to find a solution together with you. Any different amount agreed upon is stored together with your registration and is not passed on to third parties.

Legal basis: Art. 6(1)(b) GDPR (carrying out your participation or pre-contractual measures) and Art. 6(1)(c) GDPR (statutory retention obligations for invoices). Consent to photos and videos is based on Art. 6(1)(a) GDPR. It is voluntary and must be answered with “Yes” or “No” in the form; answering “No” has no disadvantages for participation. For minors, the parents or legal guardians decide. We use recordings in which you (or your child) can be seen only for the association's public relations work, for example on the website or on social media. You can withdraw your consent at any time with effect for the future by emailing herz-und-seelenstimme@tutamail.com; we will then remove recordings from our own channels as far as we are able to.

Storage and recipients: The registration is sent to us by email via the server of our hosting provider (see the “Hosting” section) and is additionally stored in a non-public participant list on this server. Only the Board has access to this list, protected by a password. In the list we also note whether the fee has been paid. The data is not passed on to any other third parties.

Storage period: We delete your registration data no later than three months after the performance. If you cancel your registration, we remove you from the participant list immediately. If you have consented to being informed about upcoming projects, you remain on that list with the information mentioned in Section 5 until you withdraw your consent. After that, only the invoice (name, address, amount) is kept in the association's accounting records, because as an association we are legally required to do so (Art. 6(1)(c) GDPR). As soon as this legal obligation ends, the invoice is deleted as well.

Waiting list: If all places are taken, we will, at your request, put you on a waiting list using the registration form. For this purpose we store your name, date of birth, for children the name of the parent or legal guardian, email address and phone number (if provided), and send you an email as soon as a place becomes available. We do not store the other information from the form for this purpose. If you register, we remove you from the waiting list. Otherwise, we delete the waiting list no later than after the performance. You can ask to be removed from the waiting list at any time by email. The legal basis is Art. 6(1)(b) GDPR (your request to participate).

5. Information about dates & offerings

If you sign up via the newsletter form on the homepage (“Always in the loop”, first name and email address only), tick the box in the contact form saying that you would like to be informed about new dates, workshops and offerings, or ask us to do so by email, we use your name and email address exclusively to inform you about the association's offerings, dates and events. This is voluntary. If you sign up via the newsletter form or tick the box in the contact form, we first send you an email with a confirmation link (double opt-in). Only once you click it do we add you to a non-public list on our hosting provider's server, which only the Board can access with a password. Until then, we keep a note of your name, email address and the time of your request; unconfirmed requests are deleted after 30 days. The data remains stored until you withdraw your consent. At the end of our emails you will also find a link that lets you unsubscribe with a single click.

The same applies if, when registering for the Christmas Singing, you tick the box saying that you would like to be informed about upcoming projects in which you (or your child) can take part. The box is not pre-ticked; leaving it unticked has no disadvantages for your registration. For this purpose we keep a separate list with your name, date of birth, for children the name of the parent or legal guardian, phone number (if provided), email address and the project you had registered for. The date of birth helps us offer you projects suited to your age. We keep this information even after the rest of the registration data has been deleted (see Section 4), until you withdraw your consent or the association no longer offers such projects.

Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time with effect for the future by sending us an email at herz-und-seelenstimme@tutamail.com.

6. Hosting

This website is hosted by checkdomain GmbH, Große Burgstraße 27/29, 23552 Lübeck, Germany. When you visit our website, the hosting provider automatically collects and stores information in so-called server log files, which your browser transmits automatically. These are: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request, and IP address.

This data is not combined with other data sources. The processing is based on Art. 6(1)(f) GDPR (legitimate interest in the stable and secure operation of the website). The hosting provider is based in Germany; to that extent, no data is transferred to a third country. The data submitted via the contact and registration forms and the participant list (see Sections 3 and 4) are also stored on the hosting provider's server. We have concluded a data processing agreement with the provider pursuant to Art. 28 GDPR. For further information, please see checkdomain's privacy policy at checkdomain.de/agb/datenschutz.

7. Cookies & audience measurement

Our public pages do not set any cookies and do not use any third-party services for audience measurement or advertising. To see how many people visit our pages, we count page views ourselves on our server. So that the same visitor is only counted once per day, we create a shortened checksum from the IP address and browser identifier together with a random value that is newly generated every day. The IP address itself is not stored, and the checksum is only used for the day in question and deleted afterwards. We also count where visitors come from: only the name of the website on which you clicked a link to us is recorded (for example “google.de”, without the exact address), or a keyword contained in the link you opened (for example “?von=flyer” for a QR code). All that remains are daily figures (page views and visitors per area of the website and per source); it is not possible to identify you from them. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in understanding how our website is used). In the password-protected internal area, which is used only by the Board, a technically necessary session cookie is set. It keeps you logged in for the duration of the visit and is deleted when you close the browser. The legal basis is Art. 6(1)(f) GDPR in conjunction with § 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act).

8. External services & links

Fonts (Playfair Display, Outfit) and icons (Lucide) are stored on our own server and loaded from there. No connection to third-party servers (e.g. Google or content delivery networks) is established for this purpose when you visit the website, and no data is transmitted to such providers.

This website also contains links to external services (Telegram, YouTube). When you click these links, you leave our website. We are not responsible for the content and data protection practices of these external providers. Please refer to the respective providers' privacy policies.

9. Your rights

You have the following rights with respect to us regarding the personal data concerning you:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent at any time (Art. 7(3) GDPR)

To exercise your rights, please contact: herz-und-seelenstimme@tutamail.com

You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. The competent supervisory authority in Saarland is the Unabhängiges Datenschutzzentrum Saarland (UDS) (Independent Data Protection Center of Saarland).

10. Currency of this privacy policy

This privacy policy is currently valid and was last updated in October 2026. As our website evolves, or due to changes in legal requirements, it may become necessary to amend this privacy policy.